When you need one
| Your visitors and data use | What usually applies |
|---|---|
| Visitors from the EU or UK | Consent before analytics or ad cookies run |
| California, at CCPA thresholds | Notice, plus a Do Not Sell or Share link if you share data |
| Other U.S. states with privacy laws | Opt-out rights, mostly for larger businesses |
| Local U.S. visitors, small business | A privacy policy, often no banner required |
U.S. law changes quickly, and several states have passed consumer privacy laws with their own thresholds. Check with a lawyer for your situation.
Google's consent requirements
If you run Google Ads or analytics and get traffic from the European Economic Area, Google expects consent signals through consent mode. Consent mode passes each visitor's choice to Google's tags, so tags adjust what they store. It also lets Google model some conversions for visitors who decline.
A banner that respects visitors and speed
- Equal-weight buttons to accept or reject
- No tracking before consent where consent is required
- A link to your privacy policy
- A way to change the choice later
- Reserved space, so the page does not jump
Badly built banners hurt Core Web Vitals. A banner that pops in late and pushes content down adds layout shift, and heavy consent scripts slow the first screen.
Good example. A local roofing company with mostly U.S. visitors skips a full-screen consent wall. It shows a small notice that links to its privacy policy and loads ad tags after the page.
Bad example. The same company installs a heavy consent tool that covers half the phone screen. It blocks the call button and adds a second of load time.
Treat this as general guidance and confirm your case with a lawyer. Our web design team sets up the lightest setup your traffic and tools require.